Hello David,
The VPN connection should allow the phone to register remotely just like a connected phone. After the vpn connects you can verify this once you see the system message in the lower left of the display without any line appearances. At this point the phone has registered.
Next step, open CCA and navigate to users and extensions, the phone's mac-address should be present and the other fields should display (no info). From there you simply fill in the necessary info for the user, the phone reboots should be fully functional.
With that being said, I won't recommend upgrading firmware across the wan, as a loss in connectivity, drop packets, etc may render the phone unusable. So i would first upgrade the firmware locally and then configure the SSL vpn settings and tftp server address.
Hope this helps.
